poe-code 3.0.300 → 3.0.301

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.300",
+  "version": "3.0.301",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tiny-http-mcp-oauth-test-server/dist/cli.js

@@ -42,6 +42,9 @@ function parsePort(value) {
     if (value === undefined) {
         return 0;
     }
+    if (!isDecimalInteger(value)) {
+        throw new Error("--port must be an integer between 0 and 65535.");
+    }
     const port = Number(value);
     if (!Number.isInteger(port) || port < 0 || port > 65535) {
         throw new Error("--port must be an integer between 0 and 65535.");
@@ -52,12 +55,18 @@ function parsePositiveInteger(value, flagName) {
     if (value === undefined) {
         return 60;
     }
+    if (!isDecimalInteger(value)) {
+        throw new Error(`${flagName} must be a positive integer.`);
+    }
     const parsed = Number(value);
     if (!Number.isInteger(parsed) || parsed <= 0) {
         throw new Error(`${flagName} must be a positive integer.`);
     }
     return parsed;
 }
+function isDecimalInteger(value) {
+    return value.length > 0 && [...value].every((character) => character >= "0" && character <= "9");
+}
 function parseAbsoluteUrl(value, flagName) {
     if (value === undefined) {
         return undefined;
@@ -88,8 +97,10 @@ function parseScopes(value) {
     }
     const scopes = value
         .split(",")
-        .map((scope) => scope.trim())
-        .filter((scope) => scope.length > 0);
+        .map((scope) => scope.trim());
+    if (scopes.some((scope) => scope.length === 0)) {
+        throw new Error("--scopes must not contain empty entries.");
+    }
     if (scopes.length === 0) {
         throw new Error("--scopes must include at least one non-empty scope.");
     }
@@ -178,20 +189,27 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
         port: parsed.port,
         hostname: parsed.hostname,
     };
-    const server = createMcpOAuthTestServer(serverOptions);
-    const handle = await server.listen(listenOptions);
-    stdout.write(`${packageInfo.name} ${packageInfo.version}\n`);
-    stdout.write(`MCP URL: ${handle.mcpUrl}\n`);
-    stdout.write(`PRM URL: ${handle.prmUrl}\n`);
-    stdout.write(`AS issuer: ${handle.oauth.issuer}\n`);
-    stdout.write(`Resource: ${handle.resource}\n`);
-    if (parsed.printTestToken) {
-        const token = await handle.oauth.issueTokenFor({
-            clientId: "demo-client",
-            resource: handle.resource,
-            scopes: parsed.scopes ?? ["mcp.read"],
-        });
-        stdout.write(`Test bearer token: ${token}\n`);
+    let handle;
+    try {
+        const server = createMcpOAuthTestServer(serverOptions);
+        handle = await server.listen(listenOptions);
+        stdout.write(`${packageInfo.name} ${packageInfo.version}\n`);
+        stdout.write(`MCP URL: ${handle.mcpUrl}\n`);
+        stdout.write(`PRM URL: ${handle.prmUrl}\n`);
+        stdout.write(`AS issuer: ${handle.oauth.issuer}\n`);
+        stdout.write(`Resource: ${handle.resource}\n`);
+        if (parsed.printTestToken) {
+            const token = await handle.oauth.issueTokenFor({
+                clientId: "demo-client",
+                resource: handle.resource,
+                scopes: parsed.scopes ?? ["mcp.read"],
+            });
+            stdout.write(`Test bearer token: ${token}\n`);
+        }
+    }
+    catch (error) {
+        stderr.write(`${error instanceof Error ? error.message : String(error)}\n\n${HELP_TEXT}\n`);
+        return 1;
     }
     await (dependencies.waitForShutdown ?? waitForShutdown)(handle.close);
     return 0;

package/packages/tiny-http-mcp-oauth-test-server/dist/index.js

@@ -85,6 +85,9 @@ function normalizeScopes(scopes) {
     if (normalizedScopes.some((scope) => scope.trim().length === 0)) {
         throw new Error("scopes must contain non-empty values");
     }
+    if (normalizedScopes.some((scope) => scope.trim() !== scope || scope.includes(" "))) {
+        throw new Error("scope entries must not contain spaces");
+    }
     return normalizedScopes;
 }
 function normalizeTtlSeconds(ttlSeconds) {
@@ -94,6 +97,13 @@ function normalizeTtlSeconds(ttlSeconds) {
     }
     return normalizedTtlSeconds;
 }
+function normalizeListenPort(port) {
+    const normalizedPort = port ?? 0;
+    if (!Number.isInteger(normalizedPort) || normalizedPort < 0 || normalizedPort > 65535) {
+        throw new Error("port must be an integer between 0 and 65535");
+    }
+    return normalizedPort;
+}
 function closeServer(server) {
     return new Promise((resolve, reject) => {
         server.close((error) => {
@@ -135,9 +145,9 @@ export function createMcpOAuthTestServer(options = {}) {
             if (currentHandle !== null || listenPending) {
                 throw new Error("MCP OAuth test server is already listening");
             }
-            listenPending = true;
             const hostname = listenOptions.hostname ?? "127.0.0.1";
-            const requestedPort = listenOptions.port ?? 0;
+            const requestedPort = normalizeListenPort(listenOptions.port);
+            listenPending = true;
             let lastError;
             for (let attempt = 0; attempt < 10; attempt += 1) {
                 try {